Removal of security freeze -- Requirements and timing

(1) A consumer reporting agency shall remove a security freeze from a consumer's credit report only if: (a) (i) the consumer reporting agency receives the consumer's request through the contact method established and required in accordance with Subsection 13-45-201(5); and (ii) the consumer reporting agency receives the consumer's proper identification or unique personal identifier; or (b) the consumer makes a material misrepresentation of fact in connection with the placement of the security freeze and the consumer reporting agency notifies the consumer in writing before removing the security freeze. (2) A consumer reporting agency shall temporarily remove a security freeze upon receipt of: (a) the consumer's request through the contact method established by the consumer reporting agency in accordance with Subsection 13-45-201(5); (b) the consumer's proper identification or unique personal identifier; and (c) a specific designation of the period of time for which the security freeze is to be removed. (3) A consumer reporting agency shall remove or temporarily remove a security freeze from a consumer's credit report within: (a) three business days after the business day on which the consumer's written request to remove the security freeze is received by the consumer reporting agency at the postal address chosen by the consumer reporting agency in accordance with Subsection 13-45-201(5)(b)(i); or (b) 15 minutes after the consumer's request is received by the consumer reporting agency through a contact method described in Subsection 13-45-201(5)(b)(ii) or (iii), and includes the consumer's unique personal identifier. (4) (a) The time requirement described in Subsection (3)(b) does not apply if the consumer reporting agency's ability to remove the security freeze is prevented by: (i) an act of God, including fire, earthquakes, hurricanes, storms, or similar natural disaster or phenomena; (ii) unauthorized or illegal acts by a third party, including terrorism, sabotage, riot, vandalism, labor strikes or disputes disrupting operations, or similar occurrence; (iii) operational interruption, including electrical failure, unanticipated delay in equipment or replacement part delivery, computer hardware or software failures inhibiting response time, or similar disruption; (iv) governmental action, including emergency orders or regulations, judicial or law enforcement action, or similar directives; (v) regularly scheduled maintenance, during other than normal business hours, of, or updates to, the consumer reporting agency's systems; or (vi) commercially reasonable maintenance of, or repair to, the consumer reporting agency's systems that is unexpected or unscheduled. (b) In the event of a circumstance described in Subsection (4)(a), the consumer reporting agency shall remove the security freeze as soon as practicable.